You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: explore-analyze/alerts-cases/alerts/maintenance-windows.md
+57-5Lines changed: 57 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,11 +6,63 @@ mapped_urls:
6
6
7
7
# Maintenance windows
8
8
9
-
% What needs to be done: Align serverless/stateful
9
+
This content applies to: [![Observability](../../../images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](../../../images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)
10
10
11
-
% Scope notes: Merge these two pages
12
11
13
-
% Use migrated content from existing pages that map to this page:
12
+
::::{warning}
13
+
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.
17
+
18
+
By default, a maintenance window affects all rules in all {{kib}} apps within its space. You can refine the scope of a maintenance window by adding filters and rule categories.
19
+
20
+
Alerts continue to be generated, however notifications are suppressed as follows:
21
+
22
+
* When an alert occurs during a maintenance window, there are no notifications. When the alert recovers, there are no notifications—even if the recovery occurs after the maintenance window ends.
23
+
* When an alert occurs before a maintenance window and recovers during or after the maintenance window, notifications are sent as usual.
24
+
25
+
## Configure access to maintenance windows [setup-maintenance-windows]
26
+
27
+
To use maintenance windows, you must have the appropriate [subscription](https://www.elastic.co/subscriptions) and {{kib}} feature privileges.
28
+
29
+
* To have full access to maintenance windows, you must have `All` privileges for the **Management > Maintenance Windows** feature.
30
+
* To have view-only access to maintenance windows, you must have `Read` privileges for the **Management > Maintenance Windows** feature.
31
+
32
+
For more details, refer to [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
33
+
34
+
## Create and manange maintenance windows [manage-maintenance-windows]
35
+
36
+
In **Management > {{stack-manage-app}} > Maintenance Windows** or **{{project-settings}} > {{manage-app}} > {{maint-windows-app}}** in Serverless, you can create, edit, and archive maintenance windows.
37
+
38
+
When you create a maintenance window, you must provide a name and a schedule. You can optionally configure it to repeat daily, monthly, yearly, or on a custom interval.
:alt: The Create Maintenance Window user interface in {kib}
42
+
:class: screenshot
43
+
:::
44
+
45
+
By default, maintenance windows affect all categories of rules. The category-specific maintenance window options alter this behavior. For the definitive list of rule types in each category, refer to the [get rule types API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-alerting).
46
+
47
+
If you turn on **Filter alerts**, you can use KQL to filter the alerts affected by the maintenance window:
:alt: The Create Maintenance Window user interface in {{kib}} with alert filters turned on
51
+
:class: screenshot
52
+
:::
53
+
54
+
::::{note}
55
+
56
+
* You can select only a single category when you turn on filters.
57
+
* Some rules are not affected by maintenance window filters because their alerts do not contain requisite data. In particular, [{{stack-monitor-app}}](../../../deploy-manage/monitor/monitoring-data/kibana-alerts.md), [tracking containment](../../../explore-analyze/alerts-cases/alerts/geo-alerting.md), [{{anomaly-jobs}} health](../../../explore-analyze/machine-learning/anomaly-detection/ml-configuring-alerts.md), and [transform health](../../../explore-analyze/transforms/transform-alerts.md) rules are not affected by the filters.
58
+
59
+
::::
60
+
61
+
A maintenance window can have any one of the following statuses:
62
+
63
+
*`Upcoming`: It will run at the scheduled date and time.
64
+
*`Running`: It is running.
65
+
*`Finished`: It ended and does not have a repeat schedule.
66
+
*`Archived`: It is archived. In a future release, archived maintenance windows will be queued for deletion.
67
+
68
+
When you [view alert details](../../../explore-analyze/alerts-cases/alerts/create-manage-rules.md#rule-details) in {{kib}}, each alert shows unique identifiers for maintenance windows that affected it.
3. To detect the number of bytes served during the time window, click **When** and select `sum` as the aggregation, and `bytes` as the field to aggregate.
5. To trigger the rule when any of the top four sites exceeds 420,000 bytes over a 24 hour period, select `is above` and enter `420000`. Then click **For the last**, enter `24`, and select `hours`.
The preview chart will render showing the 24 hour sum of bytes at 4 hours intervals for the past 120 hours (the last 30 intervals).
125
120
126
121
7. Change the time window and observe the effect it has on the chart. Compare a 24 window to a 12 hour window. Notice the variability in the sum of bytes, due to different traffic levels during the day compared to at night. This variability would result in noisy rules, so the 24 hour window is better. The preview chart can help you find the right values for your rule.
127
122
8. Define the actions for your rule.
128
123
129
124
You can add one or more actions to your rule to generate notifications when its conditions are met and when they are no longer met. For each action, you must select a connector, set the action frequency, and compose the notification details. For example, add an action that uses a server log connector to write an entry to the Kibana server log:
The unique action variables that you can use in the notification are listed in [Add action variables](#action-variables-index-threshold). For more information, refer to [Actions](create-manage-rules.md#defining-rules-actions-details) and [*Connectors*](../../../deploy-manage/manage-connectors.md).
137
131
138
132
9. Save the rule.
139
133
140
134
3. Find the rule and view its details in **{{stack-manage-app}} > {{rules-ui}}**. For example, you can see the status of the rule and its alerts:
0 commit comments